SIP CLF: a common log format (CLF) for the session initiation protocol (SIP)

Authors:
Vijay K. Gurbani;Eric Burger;Carol Davids;Tricha Anjali
Affiliations:
Bell Laboratories, Alctel-Lucent;Georgetown University;Illinois Institute of Technology;Illinois Institute of Technology
Venue:
SLAML'10 Proceedings of the 2010 workshop on Managing systems via log analysis and machine learning techniques
Year:
2010

Citing 5
Cited 0

Apache: The Definitive Guide

Apache: The Definitive Guide
A Self-learning System for Detection of Anomalous SIP Messages

Principles, Systems and Applications of IP Telecommunications. Services and Security for Next Generation Networks
Session Initiation Protocol (SIP) Server Overload Control: Design and Evaluation

Principles, Systems and Applications of IP Telecommunications. Services and Security for Next Generation Networks
Initial simulation results that analyze SIP based VoIP networks under overload

ITC20'07 Proceedings of the 20th international teletraffic conference on Managing traffic performance in converged networks
Characterizing session initiation protocol (SIP) network performance and reliability

ISAS'05 Proceedings of the Second international conference on Service Availability

Quantified Score

Hi-index	0.00

Visualization

Abstract

Web servers such as Apache and web proxies like Squid support event logging using a common log format. The logs produced using these de-facto standard formats are invaluable to system administrators for troubleshooting a server and tool writers to craft tools that mine the log files and produce reports and trends. The Session Initiation Protocol (SIP) does not have a common log format, and as a result, each server supports a distinct log format. This plethora of formats discourages the creation of common tools. Whilst SIP is similar to HTTP, there are a number of fundamental differences between a session-mode protocol and a stateless request-response protocol. We propose a common log file format for SIP servers that can be used uniformly by proxies, registrars, redirect servers as well as back-to-back user agents. Such a canonical file can be used to train anomaly detection systems and feed events into a security event management system.